Is Your Website Secure?

June 2, 2022
by Security Blogger

Anyone can create a website these days, but not everyone knows how to secure one. Security can’t be an afterthought anymore, what with global cybercrime costs set to rise by 15% to $10.5 trillion/year by 2025 [1]. Worryingly, web applications and remote access account for 50% of breaches today [2]. Gone are the days when only select websites conducting sensitive transactions had to fortify their security. Everyone is at risk; even small businesses can fall prey to attacks since they make for easy targets due to a lack of security infrastructure. No one wants their passwords stolen, data breached, or finances exposed.

If you’re a website owner, it’s high time you ask yourself: Is my website secure? We’ve compiled a list of 10 tips to help you answer that question and ensure your site is safe.

Tip 1: Check if SSL and HTTPS Are Installed

If a visitor wants to check the security of your website, one of the first things they’ll do is check if you have Secure Sockets Layer (SSL) and Hypertext Transfer Protocol Secure (HTTPS) enabled. Sites without SSL expose themselves to hackers who can hijack the connection between the server, your website, and the browser. SSL ensures that this connection is secure by forming an encrypted tunnel. HTTPS adds three layers of protection:

Data integrity: Data can’t be corrupted or modified without detection.
Authentication: Guarantees that your site is the real deal and not fake. Plus, it protects against man-in-the-middle attacks.
Encryption: Stops attackers from snooping on users and tracking their movements.

Google ranks sites without SSL low in its search results and may even warn people against them. Installing SSL and HTTPS is a great way to boost your SEO and keep your customer data safe. To check whether SSL has adequately been installed on your site, type https:// into your browser’s address bar, followed by your domain name. If you see a lock icon, you’re in the clear. It’s also a good idea to check if your website redirects to HTTPS and not HTTP. Just enter http:// followed by the domain name of any of the pages on your site and see whether you automatically get redirected to https.

Tip 2: Use Security Tools to Check Your Website

If you’re new to the world of website security, it’s a good idea to check your site’s safety through website security check tools. These will typically cross-check your site against known databases, antivirus scanners, and URL blocklisting services. All you have to do is paste your site’s URL. The scanner will inform you if the site poses any risks to visitors, such as malware, spam, and bots. This will help identify gaps in your security and allow you to make informed decisions. Popular options include Virus Total and SSL Trust, among others.

Tip 3: Keep an Eye on Passwords

You’ve probably heard this a million times, but you really should maintain unique and hard-to-crack passwords, especially for your admin-level credentials. Consider using a password generator or use your own ingenuity to come up with 16-digit codes with a random jumble of numbers, special characters, and letters. Don’t store them within the site’s directory. Keep them safe offline or in a secure location on your computer. Moreover, don’t use the same password for multiple platforms; all it takes is one data breach to expose your password. It’s also a good idea to set up multi-factor authentication. If employees have access to your site, ensure they all follow the same practices.

As for users, you must implement security measures to protect their passwords if there’s a security breach. Never store user passwords in a plain text format since that’ll make it easy for attackers to steal. Instead, keep the passwords in a hashed format. That way, hackers won’t be able to decode the password.

Tip 4: Use Discreet Error Messages

You may not think twice about the error messages users see, but hackers do. These messages could be a window into your website’s operations. For instance, you might expose error codes, database dumps, and stack traces in a detailed error message. An attacker could use these clues to check out flaws and vulnerabilities to carry out attacks. Moreover, visitors won’t be able to decipher them and understand what the issue is.

The best way to deal with this potential problem is to use easy-to-understand error messages for users and keep the detailed error messages for admins. An apology and redirect to the homepage or instructions on what to do next should suffice for the former.

Tip 5: Keep Your Admin Folders Hidden

Say an attacker is trying to gain access to your website. Giving your sensitive folders obvious names like ‘root’ or ‘admin’ will make things a lot easier for the bad actor trying to gain access. Try changing the name to something non-obvious so that they have a hard time finding sensitive data to exploit.

Tip 6: Update Your Website

Nobody wants to wait around for a software update, but in the case of cybersecurity, it’s a necessary process you have to go through to keep the latest vicious attacks out. If you’re using a CMS platform like WordPress, you must run updates for the platform itself as well as any plugins you’re using. Any delays could be exploited by hackers searching for loopholes to squeeze through. Keep your computer software updated, even if it costs you precious productivity time.

Tip 7: Secure File Uploads on Your Website

Many websites allow users to upload files, making it a potential place of attack since malicious attackers can exploit this to upload an infected file or a huge one that crashes your site. They could even overwrite your internal files. One easy option is to stop file uploads altogether, but this isn’t possible for certain businesses that need to allow user file uploads. If that’s the case, a few critical preventive measures will have to be implemented, such as:

Setting a maximum file size.
Using antivirus tools to scan files.
The upload folder should be kept outside the webroot so that hackers can’t gain access to your website.
Making a whitelist of file extensions.
Using a tool to verify those file types.
Rename uploaded files automatically so hackers can’t find them later.

Tip 8: Shield Against SQL and XSS Attacks

Structured Query Language (SQL) injections and cross-site scripting (XSS) attacks have brought many websites down. Your site could be at risk of the former if you have a URL parameter or web form that lets people enter information. Hackers can inject code into these parameters if they’re left too open, providing a key to your database. To prevent this from happening, utilize parameterized queries, ensuring that the site’s code has specific parameters that can’t be infiltrated.

As for XSS attacks, hackers stealthily drop infected JavaScript code into your website to infect user devices with malware, deface your site, or steal data. You will have to tighten your website code to protect against such attacks, particularly those concerning inputs such as fields or functions. The code must be clear and draw boundaries on what is allowed and what is not allowed, so malicious code is not permitted to enter unhindered.

Content Security Policy (CSP) can be of great help with XSS since it lets you give specific instructions to the browser on which domains it can consider legitimate sources of scripts. This way, any bad actor’s malware or script won’t be allowed to spread its wings and wreak havoc on visitors. To activate CSP, you have to set up your web server to return the Content-Security-Policy HTTP header so that it can instruct browsers on good and bad domains.

Tip 9: Moderate Your Comments

Comments are a great feedback tool for your business, letting you interact with your audience and build connections. However, it also opens up your website to trolls, bots, and fake accounts, which can ruin your site with their self-promoting or harmful content. If they post a malicious link, a user could click on it and expose their computer to viruses.

You have two options: block all comments or moderate them. The first solves the security risk immediately but will hurt user interaction. The second will require more of a time investment on your part but will likely pay off in the long run. Keep an eye out for suspicious links and spam when approving comments. You could also opt for plugins like Akismet in WordPress or similar anti-spam software. Another option is to require users to register to comment. But this might push away casual commentators who don’t want to register.

Tip 10: Back Up Your Data

Even if you follow the best practices to keep your website secure, there’s still a chance of attacks. In the case of ransomware, hackers will hold your data to ransom until you fulfill their demands. Regardless of the scenario, you should always have a backup in hand so you don’t lose any crucial data essential to your business. To achieve this, you need to run regular backups daily or weekly. Automating this process is ideal since it will ensure there’s a backup ready to go. Consider storing your backups off-site in a safe location instead of your server. You may even consider keeping them in multiple locations to be extra careful. Several backup services are available for websites, such as CodeGuard or VaultPress.

Secure Your Website with ThreatScan

Websites need constant vigilance, which is why an integrated solution is the best way forward to ensure your site is safe from threats. ThreatScan is a SaaS-based vulnerability management and penetration testing platform that goes deep into your system to scan for vulnerabilities, scrutinise risks, and help perform manual pentests. You’ll get an instant threat score to see how your application and network are faring in terms of security, along with an overall organisation score and risk posture. There’s even an easy-to-understand dashboard to manage vulnerabilities, view the status of your pentest, and much more.

If you’re new to this process or feel lost, our AI-based chatbot, Diana, will help you in real-time to submit, download, and reapply for tests. The AI-based chatbot will help you answer any questions related to cyber security or about the product. We are also available 24/7 to support you through the pentest journey. You’ll receive all ThreatScan notifications through email, Jira, and Slack integration, allowing you to take action quickly and communicate effectively with your team on your preferred platform.

To get started on your ThreatScan journey, you can contact us here.